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IN THE CLAIMS: 
Amended claims follow: 

1 . (Currently Amended) A method for detecting viruses, in software, 
comprising: 

(a) comparing subject data with a plurality of virus definitions in a first 
database; 

(b) executing a security event if the subject data is successfully compared with at 
least one of the virus definitions; 

(c) comparing the subject d ata with fingerprints of innocent data in a second 
database; 

(d) allowing access to the subject data if the subject data is successfully 
compared to the fingerprints of innocent data; and 

(e) transmitting information to a server for analysis purposes if the subject data 
is unsuccessfully compared to the virus definitions and the fingerprints of 
innocent data; 

wherein the information transmitted to the server includes at least one of the 
subject data and a fingerprint associated with the subject data; 

wherein the analysis utilizes a virus detection algorithm to detect whether the 
subject data is malicious or innocent . 

2. (Currently Amended) The method as recited in claim 1, wherein the security 
event is selected from the group consisting of cleaning the subject data, 
quarantining the subject data, and blocking the subject data. 

3. (Currently Amended) The method as recited in claim 1, and further 
comprising reporting that the subject data is innocent if the subject data is 
successfully compared to the fingerprints of innocent data. 
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4. (Cancelled) 

5. (Cancelled) 

6. (Currently Amended) The method as recited in claim #1, and further 
comprising comparing the fingerprint associated with the subject data and 
fingerprints associated with innocent data in a third database at the server. 

7. (Currently Amended) The method as recited in claim 6, and further 
comprising comparing the fingerprint associated with the subject d ata and 
fingerprints associated, with virus definitions in a fourth database at the 
server. 

8. (Original) The method as recited in claim 7, wherein the third and fourth 
databases are updated more frequently than the first and second databases. 

9. {Currently Amended) The method as recited in claim 7, and further 
comprising transmitting the subject d ata to the server utilizing thea network 
upon an unsuccessful comparison of the fingerprint associated with the 
subject data and fingerprints associated with the innocent data in the third 
database and the virus definitions in the fourth database at the server. 

] 0. (Currently Amended) The method as recited in claim 9, and further 
comprising analyzing the subject data transmitted to the server. 

1 1 . (Currently Amended) The method as recited in claim 9, wherein the subject 
data is transmitted to the server in separate parts. 

12. (Original) The method as recited in claim 10, and further comprising 
updating at least one of the first database, the second database, the third 
database, and the fourth database based on the analysis. 
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13. (Original) The method as recited in claim 1, wherein the information is 
transmitted to the server via the Internet. 

14. (Currently Amended) The method as recited in claim I, wherein the first 
database and the second database are both components of a client computer 
coupled to the server via thea network. 

15. (Currently Amended) A computer program product for detecting viruses in 
software, comprising: 

(a) computer code for comparing subject d ata with a plurality of virus 
definitions in a first database; 

(b) computer code for executing a security event if the subject data is 
successfully compared with at least one of the virus definitions; 

(c) computer code for comparing the subject data with fingerprints of innocent 
data in a second database; 

(d) computer code for allowing access to the subject data if the subject data is 
successfully compared to the fingerprints of innocent data; and 

(e) computer code for transmitting information to a server for analysis purposes 
if the subject d ata is unsuccessfully compared to the virus definitions and the 
fingerprints of innocent data^ 

wherein the information transmitted to the server includes at least one of the 
subject data and a fingerprint associated with the subject data; 
wherein the analysis utilises a virus detection algorithm to detect whether the 
subject data is malicious or innocent . 

16. (Currently Amended) The computer program product as recited in claim 15, 
wherein the security event is selected from the group consisting of cleaning 
the subject d ata, quarantining the subject data, and blocking the subject d ata. 
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1 7. (Currently Amended) The computer program product as recited in claim 1 5, 
and further comprising computer code for reporting that the subject data is 
innocent if the subject d ata is successfully compared to the fingerprints of 
innocent data. 

18. (Cancelled) 

19. (Cancelled) 

20. (Currently Amended) The computer program product as recited in claim 195, 
and further comprising computer code for comparing the fingerprint 
associated with the subjec t data and fingerprints associated with innocent 
data in a third database at the server. 

21 . (Currently Amended) The computer program product as recited in claim 20, 
and further comprising computer code for comparing the fingerprint 
associated with the subject data and fingerprints associated with virus 
definitions in a fourth database at the server. 

22. (Original) The computer program product as recited in claim 2 1 , wherein the 
third and fourth databases are updated more frequently than the first and 
second databases. 

23. (Currently Amended) The computer program product as recited in claim 21, 
and further comprising computer code for transmitting the subject data to the 
server utilizing thea network upon an unsuccessful comparison of the 
fingerprint associated with the subject data and fingerprints associated with 
the innocent data in the third database and the virus definitions in the fourth 
database at the server. 
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24. (Currently Amended) The computer program product as recited in claim 23, and 
further comprising computer code for analyzing the subject d ata transmitted to the server. 

25. (Currently Amended) The computer program product as recited in claim 24, 
wherein the subject data is transmitted to the server in separate parts. 

26. (Original) The computer program product as recited in claim 24, and further 
comprising computer code for updating at least one of the first database, the second 
database, the third database, and the fourth database based on the analysis. 

27. (Original) The computer program product as recited in claim 15, wherein the 
information is transmitted to the server via the Internet. 

28. (Currently Amended) The computer program product as recited in claim 1 5, 
wherein the first database and the second database are both components of a client 
computer coupled to the server via thea network. 

29. (Currently Amended) A system for detecting viruses in software, comprising: 

(a) logic for comparing subject data with a plurality of virus definitions in a first 
database; 

(b) logic for executing a security event if the subject data is successfully compared 
with at least one of the virus definitions; 

(c) logic for comparing the subject data with fingerprints of innocent data in a second 
database; 

(d) logic for allowing access to the subject data if the subject data is successfully 
compared to the fingerprints of innocent data; and 

(e) logic for transmitting information for analysis purposes if the subject data is 
unsuccessfully compared to the virus definitions and the fingerprints of innocent 
data: 

wherein the information transmitted to the server includes at least one of the 
subject data and a fingerprint associated with the subject data: 
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wherein the analysis utilizes a virus detection algorithm to detect whether the 
subject data is malicious or innocent . 

30. (Currently Amended) A client bas e d method for detecting viruses in software, 
comprising: 

(a) comparing subject data with a plurality of virus definitions in a first database; 

(b) executing a security event if the subject data is successfully compared with at 
least one of the virus definitions; 

(c) comparing the subject data with fingerprints of innocent data in a second 
database; 

(d) reporting that the subject d ata is innocent if the subject data is successfully 
compared to the fingerprints of innocent data; and 

(e) transmitting the subject d ata over a network for analysis purposes if the subject 
data is unsuccessfully compared to the virus definitions and the fingerprints of 
innocent data; 

wherein the analysis utilizes a virus detection algorithm to detect whether the 
subject data is malicious or innocent . 

3 1 . (Currently Amended) A server based method for detecting viruses in software, 
comprising: 

(a) receiving a fingerprint associated with subject data from a client computer for 
analysis purposes upon the subject d ata being unsuccessfully compared to virus 
definitions and fingerprints of innocent data stored on the client computer; 

(b) comparing the fingerprint associated with the subject d ata and the fingerprints 
associated with fingerprints of -innocent data at a server; 

(c) comparing the fingerprint associated with the subject data and fingerprints 
associated with virus definitions at the server; 

(d) requesting the subject data from the client computer utilizing thea network upon 
an unsuccessful comparison of the fingerprint associated with the subject data, 
and the fingerprints associated with the innocent data and the virus definitions at 
the server; 
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(e) receiving the subject d ata transmitted from the client computer in response to the 
request; 

(f) analyzing the subject data transmitted from the client computer; and 

(g) updating at least one of the virus definitions and the fingerprints of innocent data 
based on the analysis; 

wherein the analysis utilizes a virus detection algorithm to detect w hether the 
subject data is malicious or innocent . 

32. (Currently Amended) A server based method for detecting viruses in software, 
comprising: 

(a) receiving a fingerprint associated with subject data from a client computer for 
analysis purposes upon the subject d ata being unsuccessfully compared to virus 
definitions stored on the client computer; 

(b) comparing the fingerprint associated with the subject data^ and fingerprints 
associated with virus definitions at a server; 

(c) requesting the subject data from the client computer utilizing thea network upon 
an unsuccessful comparison of the fingerprint associated with the subject d ata, 
and the fingerprints associated with the virus definitions at the server; 

(d) receiving the subject data transmitted from the client computer in response to the 
request; 

(e) analyzing the subject data transmitted from the client computer; and 

(f) updating the virus definitions based on the analysis: 

wherein the analysis utilizes a virus detection algorithm to detect whether the 
subject data is malicious or innocent . 

33. (Currently Amended) A server bas e d security method, comprising: 

(a) receiving a fingerprint associated with subject d ata from a client computer for 
analysis purposes upon the subject data being unsuccessfully compared to 
fingerprints associated with innocent data stored on the client computer; 

(b) comparing the fingerprint associated with the subject data, and fingerprints 
associated with innocent data at a server; 
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(c) requesting the subject data from the client computer utilizing thea network upon 
an unsuccessful comparison of the fingerprint associated with the subject d ata, 
and the fingerprints associated with the innocent data at the server; 

(d) receiving the subject data transmitted from the client computer in response to the 
request; 

(e) analyzing the subject data transmitted from the client computer; and 

(f) updating the fingerprints associated with the innocent data based on the analysis; 
wherein the analysis utilizes a virus detection algorithm to detect whether the 
subject data is malicious or innocent . 
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